# 5.7 million California students' data stolen in breach

> Educational Testing Service, a third-party contractor for the California Department of Education, suffered a data breach affecting millions of students' personal information over four months.
- Title: 5.7 million California students' data stolen in breach
- Summary: Educational Testing Service, a third-party contractor for the California Department of Education, suffered a data breach affecting millions of students'…
- Keywords: breaking, educational testing service, california department of education, data breach, student data, cybersecurity, identity theft, technology, million, California, students', data
- Source: TechRadar — https://techradar.com/pro/security/millions-of-california-students-have-sensitive-data-stolen-names-ssids-home-addresses-and-more-taken-in-attack-on-nonprofit
- Published: 2026-10-20T17:25:00+00:00
- Read time: 1 min
- Topics: breaking, educational testing service, california department of education, data breach, student data, cybersecurity, identity theft, technology
## Millions of California students affected
Malwarebytes reports that millions of current and former California public school students had sensitive personal information stolen following a massive data breach at Educational Testing Service.
## ETS breach exposed student files
The breach occurred in a Secure File Transfer Protocol system used by Educational Testing Service, a third party contractor for the California Department of Education managing student information.
## Scale of the breach
The state's public schools counted more than five point seven million students in the two thousand twenty-five to two thousand twenty-six year alone.
## Timeline of the attack
Attackers accessed and copied student files multiple times between May twenty-second and September eighteenth. The activity was discovered on September twenty-fifth. Files contained names, addresses, dates of birth and more.
## Attackers used stolen passwords
Rather than exploiting a software vulnerability, attackers are believed to have gained access via compromised credentials. The specific attack vector details have not been shared by Educational Testing Service or the California Department of Education.
## Response and protections offered
Educational Testing Service and the California Department of Education are notifying impacted individuals and providing twenty-four months of free identity protection software.No evidence shows stolen information was publicly released or that a ransom was demanded.

> We have implemented additional safeguards, including enhanced monitoring, strengthened access controls, and further third-party review of our security practices.
## Key takeaway

Attackers accessed an Educational Testing Service system used by California's Department of Education for four months, stealing names, addresses and dates of birth from an estimated 5.7 million students per year.